Extracted

• • Target

    e9a72688b0347aae595ef4d1918b2ce0_JaffaCakes118

  • Size

    204KB

  • MD5

    e9a72688b0347aae595ef4d1918b2ce0

  • SHA1

    5369efd0697bccd73fdbc9544c06b524b15a352e

  • SHA256

    1993c97f06281c83ca954f4cd75de73c8fbb80f8c1c175c40fdb6ed47be35b45

  • SHA512

    272d8aa8bbf5a240abd3f4d61cc878c2bd7c18c5236f2c0ae70bd14958f3c87dd1cb2392460fe075ea0bf92bd4b8df99af12c8efc023dd4afbc83c8de46b1370

  • SSDEEP

    3072:2fUVnTNXt1K4mvNrw1mFujqr2x7TtUJrX4p/+AbAsZf8NxI/sF:2fUVnTJK4ml6q6xXtUJrX4l+kAGExI/o

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2